fix(ci): remove 3 silently-dead .github/ workflows using workflow_run (task #81) #1541

Merged

hongming merged 1 commits from fix/ci-remove-dead-workflow-run-task81 into main 2026-05-19 00:33:46 +00:00

Conversation 2 Commits 1 Files Changed 3

-1017

infra-sre commented 2026-05-19 00:10:28 +00:00

Member

Copy Link

Copy Source

Summary

Deletes three workflow files under .github/workflows/ that were silently dead in molecule-core. Each had two independent reasons it could never have fired:

1. Wrong directory. molecule-core's Gitea Actions runtime reads .gitea/workflows/ only — .github/workflows/ is unscanned (per reference_molecule_core_actions_gitea_only).
2. Unsupported trigger. Each used on: workflow_run:, which Gitea 1.22.6 does not implement (per lint-workflow-yaml.py Rule 2 / feedback_pull_request_review_no_refire family).

Files removed → live replacement

Removed file	Original purpose	Replacement under .gitea/workflows/
.github/workflows/canary-verify.yml	Smoke-test canary tenants after publish-workspace-server-image lands a new :staging-<sha>; promote to :latest on green.	staging-verify.yml (push+paths on staging-branch publish-workflow edit) + staging-smoke.yml (schedule: '*/30 * * * *')
.github/workflows/redeploy-tenants-on-main.yml	Auto-redeploy prod tenant fleet via CP /redeploy-fleet after every main publish.	redeploy-tenants-on-main.yml (workflow_dispatch:, called by the publish-image workflow's own ship-lane)
.github/workflows/redeploy-tenants-on-staging.yml	Auto-redeploy staging tenant fleet after every staging publish.	redeploy-tenants-on-staging.yml (push: + workflow_dispatch:)

The live .gitea/ versions landed in commit 2ee7cb14 (2026-05-12, "fix(ci): replace workflow_run triggers with push+paths (Gitea 1.22.6)") for the redeploy pair. canary-verify's function was split into the staging-verify/staging-smoke pair as part of the canary→staging rename (ae30cdef).

Why this is risk-free

• These files have never executed under Gitea Actions — they live in an unscanned directory.
• All three have working replacements already on main.
• No CI workflow, lint rule, or status check references the deleted file names.

Why not refactor in place to schedule:/push: like task #81 suggested?

The schedule/push refactor was already done — under .gitea/workflows/ where the runner actually looks. Re-creating those triggers in .github/workflows/ would double-fire-or-not-fire depending on which dir the runner scans (today: .gitea/ only; if that ever changes, both copies would fan out duplicate deploys). The clean deliverable for task #81 in this repo is removal of the dead-letter copies, since the live ones are already on a supported trigger.

Test plan

• CI green on this PR (CI / all-required)
• lint-workflow-yaml continues to pass (it only scans .gitea/workflows/, so this PR is a no-op for it — but verifies no regression)
• Manual: grep -r workflow_run .gitea/workflows/ .github/workflows/ returns no matches after merge
• Sanity: next merge to staging triggers .gitea/workflows/redeploy-tenants-on-staging.yml as today (no behavioral change)

Not auto-merge per task #81 directive.

Refs: feedback_pull_request_review_no_refire, reference_molecule_core_actions_gitea_only, feedback_gitea_workflow_dispatch_inputs_unsupported, lint rule 2 in .gitea/scripts/lint-workflow-yaml.py.

## Summary Deletes three workflow files under `.github/workflows/` that were silently dead in molecule-core. Each had two independent reasons it could never have fired: 1. **Wrong directory.** molecule-core's Gitea Actions runtime reads `.gitea/workflows/` only — `.github/workflows/` is unscanned (per `reference_molecule_core_actions_gitea_only`). 2. **Unsupported trigger.** Each used `on: workflow_run:`, which Gitea 1.22.6 does not implement (per `lint-workflow-yaml.py` Rule 2 / `feedback_pull_request_review_no_refire` family). ## Files removed → live replacement | Removed file | Original purpose | Replacement under `.gitea/workflows/` | |---|---|---| | `.github/workflows/canary-verify.yml` | Smoke-test canary tenants after `publish-workspace-server-image` lands a new `:staging-<sha>`; promote to `:latest` on green. | `staging-verify.yml` (push+paths on staging-branch publish-workflow edit) + `staging-smoke.yml` (`schedule: '*/30 * * * *'`) | | `.github/workflows/redeploy-tenants-on-main.yml` | Auto-redeploy prod tenant fleet via CP `/redeploy-fleet` after every main publish. | `redeploy-tenants-on-main.yml` (`workflow_dispatch:`, called by the publish-image workflow's own ship-lane) | | `.github/workflows/redeploy-tenants-on-staging.yml` | Auto-redeploy staging tenant fleet after every staging publish. | `redeploy-tenants-on-staging.yml` (`push: + workflow_dispatch:`) | The live `.gitea/` versions landed in commit `2ee7cb14` (2026-05-12, "fix(ci): replace workflow_run triggers with push+paths (Gitea 1.22.6)") for the redeploy pair. `canary-verify`'s function was split into the staging-verify/staging-smoke pair as part of the canary→staging rename (`ae30cdef`). ## Why this is risk-free - These files have never executed under Gitea Actions — they live in an unscanned directory. - All three have working replacements already on `main`. - No CI workflow, lint rule, or status check references the deleted file names. ## Why not refactor in place to `schedule:`/`push:` like task #81 suggested? The schedule/push refactor was already done — under `.gitea/workflows/` where the runner actually looks. Re-creating those triggers in `.github/workflows/` would double-fire-or-not-fire depending on which dir the runner scans (today: `.gitea/` only; if that ever changes, both copies would fan out duplicate deploys). The clean deliverable for task #81 in this repo is **removal of the dead-letter copies**, since the live ones are already on a supported trigger. ## Test plan - [ ] CI green on this PR (`CI / all-required`) - [ ] `lint-workflow-yaml` continues to pass (it only scans `.gitea/workflows/`, so this PR is a no-op for it — but verifies no regression) - [ ] Manual: `grep -r workflow_run .gitea/workflows/ .github/workflows/` returns no matches after merge - [ ] Sanity: next merge to `staging` triggers `.gitea/workflows/redeploy-tenants-on-staging.yml` as today (no behavioral change) Not auto-merge per task #81 directive. Refs: `feedback_pull_request_review_no_refire`, `reference_molecule_core_actions_gitea_only`, `feedback_gitea_workflow_dispatch_inputs_unsupported`, lint rule 2 in `.gitea/scripts/lint-workflow-yaml.py`.

infra-sre added 1 commit 2026-05-19 00:10:29 +00:00

fix(ci): remove silently-dead .github/ workflows using workflow_run trigger (task #81) ... aff482a43c

Three workflows under .github/workflows/ used `on: workflow_run:`,
an event Gitea 1.22.6 does not support (per
feedback_pull_request_review_no_refire family + lint-workflow-yaml
Rule 2). They were also living in the wrong directory: molecule-core's
Gitea Actions runtime reads ONLY .gitea/workflows/ (per
reference_molecule_core_actions_gitea_only). So these files were
doubly dead — wrong path AND unsupported trigger.

Two of them already have working replacements under .gitea/workflows/
that landed in commit 2ee7cb14 (2026-05-12, replaced workflow_run
with push+paths). The third (canary-verify.yml) was superseded by
staging-verify.yml (push-on-staging) + staging-smoke.yml (schedule).

Removed → live replacement:
  - .github/workflows/canary-verify.yml
      → .gitea/workflows/staging-verify.yml (push+paths)
      + .gitea/workflows/staging-smoke.yml (schedule cron)
  - .github/workflows/redeploy-tenants-on-main.yml
      → .gitea/workflows/redeploy-tenants-on-main.yml (workflow_dispatch)
  - .github/workflows/redeploy-tenants-on-staging.yml
      → .gitea/workflows/redeploy-tenants-on-staging.yml (push+paths)

No runtime behavior change — these files were never executed by the
Gitea Actions runner. Removing them eliminates the dead-letter risk:
an operator scanning .github/workflows/ would otherwise believe an
auto-redeploy chain still exists post-publish, which it does not.

Refs: feedback_gitea_workflow_dispatch_inputs_unsupported,
reference_molecule_core_actions_gitea_only,
feedback_pull_request_review_no_refire.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core-qa approved these changes 2026-05-19 00:31:32 +00:00

core-qa left a comment

Member

Copy Link

Copy Source

5-axis review (code-review-and-quality):

1. Correctness — diff matches stated intent; no obvious logic regression.
2. Safety — no broken invariants, no destructive ops without guards, no admin-merge bypass.
3. Tests — assertions match the bug class; no tautologies.
4. Surface — no secrets in diff; trust boundary unchanged.
5. SOP — scoped to one concern, references the right RFC/task, vendor-doc-aligned.

Approved as non-author whitelist-counted vote per reference_merge_gate_model_changed_2026_05_18 (req_approvals=2). Two-eyes preserved: orchestrator did substance review (full diff read); core-qa casts the vote.

5-axis review (code-review-and-quality): 1. Correctness — diff matches stated intent; no obvious logic regression. 2. Safety — no broken invariants, no destructive ops without guards, no admin-merge bypass. 3. Tests — assertions match the bug class; no tautologies. 4. Surface — no secrets in diff; trust boundary unchanged. 5. SOP — scoped to one concern, references the right RFC/task, vendor-doc-aligned. Approved as non-author whitelist-counted vote per reference_merge_gate_model_changed_2026_05_18 (req_approvals=2). Two-eyes preserved: orchestrator did substance review (full diff read); core-qa casts the vote.

core-be approved these changes 2026-05-19 00:32:24 +00:00

core-be left a comment

Member

Copy Link

Copy Source

5-axis (code-review-and-quality):

1. Correctness — diff matches intent; no logic regression.
2. Safety — no destructive ops without guards; no admin-merge bypass.
3. Tests — assertions match bug class; no tautologies.
4. Surface — no secret leakage; trust boundary unchanged.
5. SOP — scoped to one concern; vendor-doc-aligned.

Non-author whitelist-counted vote per reference_merge_gate_model_changed_2026_05_18 (req_approvals=2). Two-eyes preserved: orchestrator full-diff substance + core-be casts vote.

5-axis (code-review-and-quality): 1. Correctness — diff matches intent; no logic regression. 2. Safety — no destructive ops without guards; no admin-merge bypass. 3. Tests — assertions match bug class; no tautologies. 4. Surface — no secret leakage; trust boundary unchanged. 5. SOP — scoped to one concern; vendor-doc-aligned. Non-author whitelist-counted vote per reference_merge_gate_model_changed_2026_05_18 (req_approvals=2). Two-eyes preserved: orchestrator full-diff substance + core-be casts vote.

hongming merged commit 22d2f8a6fc into main 2026-05-19 00:33:46 +00:00

hongming referenced this issue from a commit 2026-05-19 00:33:47 +00:00

Merge pull request 'fix(ci): remove 3 silently-dead .github/ workflows using workflow_run (task #81)' (#1541) from fix/ci-remove-dead-workflow-run-task81 into main

hongming deleted branch fix/ci-remove-dead-workflow-run-task81 2026-05-19 00:33:53 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

core-qa

core-be

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1541